1 <?

     2 

     3 // +--------------------------------------------------------------------+

     4 // | PowerAdmin                                                         |

     5 // +--------------------------------------------------------------------+

     6 // | Copyright (c) 1997-2002 The PowerAdmin Team                        |

     7 // +--------------------------------------------------------------------+

     8 // | This source file is subject to the license carried by the overal   |

     9 // | program PowerAdmin as found on http://poweradmin.sf.net            |

    10 // | The PowerAdmin program falls under the QPL License:                |

    11 // | http://www.trolltech.com/developer/licensing/qpl.html              |

    12 // +--------------------------------------------------------------------+

    13 // | Authors: Roeland Nieuwenhuis <trancer <AT> trancer <DOT> nl>       |

    14 // |          Sjeemz <sjeemz <AT> sjeemz <DOT> nl>                      |

    15 // +--------------------------------------------------------------------+

    16 

    17 // Filename: users.inc.php

    18 // Startdate: 26-10-2002

    19 // Description: all user modifications etc. are done here

    20 //

    21 // $Id: users.inc.php,v 1.8 2003/01/01 22:33:47 azurazu Exp $

    22 //

    23 

    24 

    25 

    26 /*

    27  * Retrieve all users.

    28  * Its to show_users therefore the odd name. Has to be changed.

    29  * return values: an array with all users in it.

    30  */

    31 function show_users($id='',$rowstart=0,$rowamount=9999999)

    32 {

    33  	global $db;

    34  	if(is_numeric($id))

    35  	{

    36                  //When a user id is given, it is excluded from the userlist returned.

    37                  $add = " WHERE users.id!=$id";

    38 	}

    39 

    40 	// Make a huge query.

    41 	$sqlq = "SELECT users.id AS id,

    42 		users.username AS username,

    43 		users.fullname AS fullname,

    44 		users.email AS email,

    45 		users.description AS description,

    46 		users.level AS level,

    47 		users.active AS active,

    48 		count(zones.owner) AS aantal FROM users

    49 		LEFT JOIN zones ON users.id=zones.owner$add

    50 		GROUP BY

    51 			users.id,

    52 			users.username,

    53 			users.fullname,

    54 			users.email,

    55 			users.description,

    56 			users.level,

    57 			users.active

    58 		ORDER BY

    59 			users.fullname

    60 	 	LIMIT $rowstart,$rowamount";

    61 

    62 	// Execute the huge query.

    63 	$result = $db->query($sqlq);

    64 	$ret = array();

    65 	$retcount = 0;

    66 	while ($r = $result->fetchRow())

    67 	{

    68 		$ret[] = array(

    69 		 "id"                    =>              $r["id"],

    70 		 "username"              =>              $r["username"],

    71 		 "fullname"              =>              $r["fullname"],

    72 		 "email"                 =>              $r["email"],

    73 		 "description"           =>              $r["description"],

    74 		 "level"                 =>              $r["level"],

    75 		 "active"                =>              $r["active"],

    76 		 "numdomains"            =>              $r["aantal"]

    77 		);

    78 	}

    79 	return $ret;

    80 }

    81 

    82 

    83 /*

    84  * Check if the given $userid is connected to a valid user.

    85  * return values: true if user exists, false if users doesnt exist.

    86  */

    87  function is_valid_user($id)

    88 {

    89 	global $db;

    90 	if(is_numeric($id))

    91 	{

    92 		$result = $db->query("SELECT id FROM users WHERE id=$id");

    93 		if ($result->numRows() == 1)

    94 		{

    95 			return true;

    96 		}

    97 		else

    98 		{

    99 			return false;

   100 		}

   101 	}

   102 }

   103 

   104 

   105 /*

   106  * Gives a textdescribed value of the given levelid

   107  * return values: the text associated with the level

   108  */

   109 function leveldescription($id)

   110 {

   111 	// Fixed descriptions for each user level (feel free to edit, anyway..)

   112 	// Will get moved to the config file soon.

   113 	switch($id)

   114 	{

   115 		case 1:

   116 			global $NAME_LEVEL_1;

   117 			return $NAME_LEVEL_1;

   118 			break;

   119 		case 5:

   120 			global $NAME_LEVEL_5;

   121 			return $NAME_LEVEL_5;

   122 			break;

   123 		case 10:

   124 			global $NAME_LEVEL_10;

   125 			return $NAME_LEVEL_10;

   126 			break;

   127 		default:

   128 			return "Unknown";

   129 			break;

   130 	}

   131 }

   132 

   133 

   134 /*

   135  * Checks if a given username exists in the database.

   136  * return values: true if exists, false if not.

   137  */

   138 function user_exists($user)

   139 {

   140 	global $db;

   141 	$result = $db->query("SELECT id FROM users WHERE username='$user'");

   142 	if ($result->numRows() == 0)

   143 	{

   144                  return false;

   145 	}

   146 	elseif($result->numRows() == 1)

   147 	{

   148         	return true;

   149 	}

   150         else

   151         {

   152         	error(ERR_UNKOWN);

   153 	}

   154 }

   155 

   156 

   157 /*

   158  * Get all user info for the given user in an array.

   159  * return values: the database style array with the information about the user.

   160  */

   161 function get_user_info($id)

   162 {

   163 	global $db;

   164 	if (is_numeric($id))

   165 	{

   166 		$result = $db->query("SELECT id, username, fullname, email, description, level, active from users where id=$id");

   167 		$r = $result->fetchRow();

   168 		return $r;

   169 	}

   170 	else

   171 	{

   172 		error(sprintf(ERR_INV_ARGC,"get_user_info", "you gave illegal arguments: $id"));

   173 	}

   174 }

   175 

   176 

   177 /*

   178  * Delete a user from the system

   179  * return values: true if user doesnt exist.

   180  */

   181 function delete_user($id)

   182 {

   183 	global $db;

   184 	if (!level(10))

   185 	{

   186 		error(ERR_LEVEL_10);

   187 	}

   188 	if (is_numeric($id))

   189 	{

   190         	$db->query("DELETE FROM users WHERE id=$id");

   191         	$db->query("DELETE FROM zones WHERE owner=$id");

   192         	return true;

   193         	// No need to check the affected rows. If the affected rows would be 0,

   194         	// the user isnt in the dbase, just as we want.

   195         }

   196 	else

   197 	{

   198 		error(ERR_INV_ARG);

   199 	}

   200 }

   201 

   202 

   203 /*

   204  * Adds a user to the system.

   205  * return values: true if succesfully added.

   206  */

   207 function add_user($user, $password, $fullname, $email, $level, $description, $active)

   208 {

   209 	global $db;

   210 	if (!level(10))

   211 	{

   212 		error(ERR_LEVEL_10);

   213 	}

   214 	if (!user_exists($user))

   215 	{

   216 		// Might have to be changed.

   217 		// TODO probably.

   218 		$description = mysql_escape_string($description);

   219 

   220 		// Clean up the fullname

   221 		$fullname = mysql_escape_string($fullname);

   222 		is_valid_email($email);

   223 

   224 		// Get id and insert information.

   225 		$idusers= $db->nextID('users');

   226 		$db->query("INSERT INTO users (id, username, password, fullname, email, description, level, active) VALUES ($idusers, '$user', '" . md5($password) . "', '$fullname', '$email', '$description', '$level', '$active')");

   227 		return true;

   228 	}

   229 	else

   230 	{

   231 		error(ERR_USER_EXISTS);

   232 	}

   233 }

   234 

   235 

   236 /*

   237  * Edit the information of an user.. sloppy implementation with too many queries.. (2) :)

   238  * return values: true if succesful

   239  */

   240 function edit_user($id, $user, $fullname, $email, $level, $description, $active, $password)

   241 {

   242 	global $db;

   243 	if(!level(10)) {

   244 		error(ERR_LEVEL_10);

   245 	}

   246 

   247   	// Might have to be changed.

   248   	// TODO

   249 	$description = mysql_escape_string($description);

   250 	$fullname = mysql_escape_string($fullname);

   251 	is_valid_email($email);

   252 

   253 	$sqlquery = "UPDATE users set username='$user', fullname='$fullname', email='$email', level=$level, description='$description', active=$active ";

   254 

   255 	if($password != "")

   256 	{

   257 		$sqlquery .= ", password= '" . md5($password) . "' ";

   258 	}

   259 

   260 	$sqlquery .= "where id=$id" ;

   261 

   262   	// Search the username that right now goes with this ID.

   263 	$result = $db->query("SELECT username from users where id=$id");

   264 	$r = array();

   265 	$r = $result->fetchRow();

   266 

   267   	// If the found username with this ID is the given username with the command.. execute.

   268 

   269 	if($r["username"] == $user)

   270 	{

   271 		$db->query($sqlquery);

   272   		return true;

   273   	}

   274 

   275   	// Its not.. so the user wants to change.

   276   	// Find if there is an id that has the wished username.

   277   	$otheruser = $db->query("SELECT id from users where username='$user'");

   278   	if($otheruser->numRows() > 0)

   279   	{

   280   		error(ERR_USER_EXIST);

   281   	}

   282 

   283   	// Its fine it seems.. :)

   284   	// Lets execute it.

   285   	else

   286   	{

   287 		$db->query($sqlquery);

   288 		return true;

   289 	}

   290 }

   291 

   292 /*

   293  * Change the pass of the user.

   294  * The user is automatically logged out after the pass change.

   295  * return values: none.

   296  */

   297 function change_user_pass($currentpass, $newpass, $newpass2)

   298 {

   299 	global $db;

   300 

   301 	// Check if the passwords are equal.

   302 	if($newpass != $newpass2)

   303 	{

   304 		error(ERR_USER_MATCH_NEW_PASS);

   305 	}

   306 

   307 	// Retrieve the users password.

   308 	$result = $db->query("SELECT password, id FROM users WHERE username='". $_SESSION["userlogin"]  ."'");

   309 	$rinfo = $result->fetchRow();

   310 

   311 	// Check the current password versus the database password and execute the update.

   312 	if(md5($currentpass) == $rinfo["password"])

   313 	{

   314 		$sqlquery = "update users set password='" . md5($newpass) . "' where id='" . $rinfo["id"] . "'";

   315 		$db->query($sqlquery);

   316 

   317 		// Logout the user.

   318 		logout("Pass changed please re-login");

   319 	}

   320 	else

   321 	{

   322 		error(ERR_USER_WRONG_CURRENT_PASS);

   323 	}

   324 }

   325 

   326 

   327 /*

   328  * Get a fullname when you have a userid.

   329  * return values: gives the fullname from a userid.

   330  */

   331 function get_fullname_from_userid($id)

   332 {

   333 	global $db;

   334 	if (is_numeric($id))

   335 	{

   336 		$result = $db->query("SELECT fullname FROM users WHERE id=$id");

   337 		$r = $result->fetchRow();

   338 		return $r["fullname"];

   339 	}

   340 	else

   341 	{

   342 		error(ERR_INV_ARG);

   343 	}

   344 }

   345 

   346 

   347 /*

   348  * Get a fullname when you have a userid.

   349  * return values: gives the fullname from a userid.

   350  */

   351 function get_owner_from_id($id)

   352 {

   353 	global $db;

   354 	if (is_numeric($id))

   355 	{

   356 		$result = $db->query("SELECT fullname FROM users WHERE id=$id");

   357 		if ($result->numRows() == 1)

   358 		{

   359 			$r = $result->fetchRow();

   360 			return $r["fullname"];

   361 		}

   362 		else

   363 		{

   364 			error(ERR_USER_NOT_EXIST);

   365 		}

   366 	}

   367 	error(ERR_INV_ARG);

   368 }

   369 ?>